What evidence do you require before decommissioning an internal service?

A dependency inventory is a starting point, but hidden consumers often live in scheduled jobs, DNS records, firewall rules, old scripts, monitoring checks, or a workflow that only runs monthly. A cautious checklist could combine access logs, owner sign-off, configuration searches, a read-only or blocked trial period, a tested rollback, and a final backup with a retention date. What evidence is strong enough for you to approve shutdown, and how long do you keep the rollback path?